immune-brain 3.6.5 → 3.6.7

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -1,5 +1,14 @@
 import { DynamicBorder, type ExtensionAPI, type ExtensionContext, type Theme, type ThemeColor } from "@earendil-works/pi-coding-agent";
-import { Container, SelectList, Text, type Component, type SelectItem } from "@earendil-works/pi-tui";
+import {
+	Container,
+	SelectList,
+	Text,
+	sliceByColumn,
+	truncateToWidth,
+	visibleWidth,
+	type Component,
+	type SelectItem,
+} from "@earendil-works/pi-tui";
 
 export const USER_ATTENTION_EVENT = "immune-brain:user-attention.v1" as const;
 export const TASK_RAIL_KEY = "immune-brain.task-rail" as const;
@@ -186,12 +195,7 @@ export async function requestAuthorityDialog<T extends string, R = T | undefined
 export function presentTaskRail(ctx: UiContext, view: TaskRailView): void {
 	try {
 		ctx.ui.setWidget(TASK_RAIL_KEY, (_tui, theme) => {
-			return {
-				render(width: number): string[] {
-					return renderTaskRail(view, width, theme);
-				},
-				invalidate(): void {},
-			};
+			return safeWidgetRender((width) => renderTaskRail(view, width, theme));
 		}, { placement: "aboveEditor" });
 		if (view.state === "Completed" || view.state === "Stopped") terminalRailUis.add(ctx.ui);
 		else terminalRailUis.delete(ctx.ui);
@@ -277,6 +281,25 @@ export async function presentTaskOverviewOverlay(
 	}
 }
 
+// pi renders widget lines verbatim and throws in doRender — killing the whole
+// process — when a line exceeds the terminal width. Clamp every line at the
+// widget boundary so line-builder bugs degrade to a truncated row instead.
+function safeWidgetRender(render: (width: number) => string[]): {
+	render(width: number): string[];
+	invalidate(): void;
+} {
+	return {
+		render(width: number): string[] {
+			try {
+				return render(width).map((line) => truncateToWidth(line, width, "…"));
+			} catch {
+				return [];
+			}
+		},
+		invalidate(): void {},
+	};
+}
+
 export function clearTaskRail(ctx: UiContext): void {
 	try {
 		ctx.ui.setWidget(TASK_RAIL_KEY, undefined);
@@ -501,13 +524,18 @@ function strings(value: unknown): string[] {
 	return Array.isArray(value) ? value.filter((item): item is string => typeof item === "string") : [];
 }
 
+// Truncate by terminal columns, not character count — CJK/double-width chars
+// overflow otherwise and pi's doRender crashes the whole process on wide lines.
 function bounded(value: string, max: number): string {
-	return value.length <= max ? value : `${value.slice(0, max - 1)}…`;
+	return truncateToWidth(value, max, "…");
 }
 
 function boundedMiddle(value: string, max: number): string {
-	if (value.length <= max) return value;
+	const width = visibleWidth(value);
+	if (width <= max) return value;
 	const visible = max - 1;
 	const start = Math.ceil(visible / 2);
-	return `${value.slice(0, start)}…${value.slice(-(visible - start))}`;
+	const head = truncateToWidth(sliceByColumn(value, 0, start, true), start, "");
+	const tail = truncateToWidth(sliceByColumn(value, width - (visible - start), visible - start, true), visible - start, "");
+	return `${head}…${tail}`;
 }

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -174,7 +174,15 @@ export interface TaskRecordRead {
 				manifest_digest: string;
 			};
 		}>;
-		findings: Array<{ id: string; kind: string; status: string; summary?: string }>;
+		findings: Array<{
+			id: string;
+			kind: string;
+			status: string;
+			summary?: string;
+			anchor?: string | null;
+			evidence?: unknown;
+			counterevidence?: { attestation_id: string; acceptance_id: string } | null;
+		}>;
 	} | null;
 }
 
@@ -283,7 +291,12 @@ export async function readTaskRecord(
 	taskId: string,
 ): Promise<TaskRecordRead> {
 	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
-	return mod.readTaskRecord(root, taskId);
+	// Lock-free read only. `storage.readTaskRecord` wraps this in
+	// withKernelStoreLock, which first runs pending-transaction recovery, so a
+	// decline, a cancel, or a rejected preflight would otherwise mutate Kernel
+	// state before the literal user ever approved anything. Mutating Kernel
+	// entrypoints still take their own lock when the batch actually starts.
+	return mod.readTaskRecordRaw(root, taskId);
 }
 export async function withKernelStoreLock<T>(root: string, operation: () => T): Promise<T> {
 	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
@@ -403,3 +416,188 @@ export async function deriveAssuranceAuthorization(input: {
 	const mod = await import(/* @vite-ignore */ kernelPath("assurance_projection"));
 	return mod.deriveAssuranceAuthorization(input) as AssuranceAuthorizationReadiness;
 }
+
+// --- Batch Authority & Unattended Runner Forwarding ---
+function unattendedPath(module: string): string {
+	return `../runtime/unattended/${module}.ts`;
+}
+
+export type {
+	BatchPlan,
+	BatchPlanChild,
+	BatchPlanBudget,
+	BatchPlanDigestChild,
+	InitiativeObservationReader,
+} from "../runtime/unattended/types";
+export type {
+	BatchAuthorityRegistry,
+	BatchAuthorizationBinding,
+	ValidatedBatchAuthorization,
+} from "../runtime/kernel/batch_authority";
+export type {
+	BatchRunnerKernelPort,
+	StartBatchInput,
+	BatchRunReport,
+} from "../runtime/unattended/batch_runner";
+export type {
+	BatchRunnerGitPort,
+	BatchGitPreflightResult,
+} from "../runtime/unattended/batch_git";
+
+export async function projectBatchPlan(
+	root: string,
+	initiativeSlug: string,
+	input: any,
+	readInitiative?: any,
+): Promise<any> {
+	const mod = await import(/* @vite-ignore */ unattendedPath("batch_plan"));
+	return mod.projectBatchPlan(root, initiativeSlug, input, readInitiative);
+}
+
+export async function computeBatchPlanDigest(children: any): Promise<string> {
+	const mod = await import(/* @vite-ignore */ kernelPath("batch_authority"));
+	return mod.computeBatchPlanDigest(children);
+}
+
+export async function createBatchAuthorityRegistry(): Promise<any> {
+	const mod = await import(/* @vite-ignore */ kernelPath("batch_authority"));
+	return mod.createBatchAuthorityRegistry();
+}
+
+export async function deriveChildEnrollment(root: string, registry: any, input: any): Promise<any> {
+	const mod = await import(/* @vite-ignore */ kernelPath("batch_authority"));
+	return mod.deriveChildEnrollment(root, registry, input);
+}
+
+export async function startBatch(input: any): Promise<any> {
+	const mod = await import(/* @vite-ignore */ unattendedPath("batch_runner"));
+	return mod.startBatch(input);
+}
+
+export async function runBatchGitPreflight(input: any): Promise<any> {
+	const mod = await import(/* @vite-ignore */ unattendedPath("batch_git"));
+	return mod.runBatchGitPreflight(input);
+}
+
+export async function readGitHead(root: string): Promise<string> {
+	// The Pi extension must reach Kernel prepare only through the shared Enrollment
+	// boundary, so this reads HEAD itself rather than importing the Kernel prepare
+	// module. The unattended Git module reads HEAD the same way.
+	const { spawnSync } = await import("node:child_process");
+	const result = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], { encoding: "utf8" });
+	if (result.status !== 0) throw new Error(`git rev-parse HEAD is unavailable for ${root}`);
+	return result.stdout.trim();
+}
+
+/**
+ * Read the immutable terminal audit record for a settled child.
+ *
+ * A child reaches Kernel settlement before the batch commits it, and settlement
+ * clears the live state record, so the batch resume preflight must resolve the
+ * child's authorized scope from the audit pair instead. Read-only: neither the
+ * audit pair nor this reader mutates Kernel state.
+ */
+export async function readSettledTaskRecord(
+	root: string,
+	taskId: string,
+): Promise<{ scope_hint: string[]; intent_path: string | undefined } | null> {
+	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
+	const pair = mod.readAuditTaskPair(root, taskId);
+	if (!pair?.record) return null;
+	const record = pair.record as {
+		intent_snapshot?: { scope_hint?: string[] };
+		intent_ref?: { path?: string };
+	};
+	return {
+		scope_hint: record.intent_snapshot?.scope_hint ?? [],
+		intent_path: record.intent_ref?.path,
+	};
+}
+
+export async function pathMatchesScope(path: string, scopePath: string): Promise<boolean> {
+	const mod = await import(/* @vite-ignore */ runtimePath("workspace_scope"));
+	return mod.pathMatchesScope(path, scopePath);
+}
+
+const GLOBAL_PI_PROGRESSION_KEY = Symbol.for("immune_brain.pi_assurance_progression");
+
+export async function getSharedPiProgression(): Promise<any> {
+	let progression = (globalThis as any)[GLOBAL_PI_PROGRESSION_KEY];
+	if (!progression) {
+		const workMod = await import(/* @vite-ignore */ "./imm-canary-work");
+		const ports = workMod.createPiAssuranceProgressionPorts();
+		const progMod = await import(/* @vite-ignore */ "./pi-canary-assurance-progression");
+		progression = new progMod.AssuranceProgression(ports);
+		(globalThis as any)[GLOBAL_PI_PROGRESSION_KEY] = progression;
+	}
+	return progression;
+}
+
+export async function advancePiTask(root: string, taskId: string): Promise<any> {
+	const progression = await getSharedPiProgression();
+	const result = await progression.advance(taskId, { cwd: root });
+	if (result.state === "completed") return { state: "completed" };
+	if (result.state === "stopped") return { state: "stopped" };
+	if (result.state === "rework") return { state: "rework", operation: result.operation, summary: result.summary };
+	if (result.state === "review_ready") return { state: "review_ready", operation_id: result.operation_id, agent_params: result.agent_params };
+	if (result.state === "blocked") return { state: "blocked", reason: result.reason };
+	return { state: "failed", reason: (result as { reason?: string }).reason ?? "advance failed" };
+}
+
+export async function projectAssuranceForTask(root: string, taskId: string): Promise<any> {
+	const [assuranceMod, scopeMod] = await Promise.all([
+		import(/* @vite-ignore */ kernelPath("assurance_projection")),
+		import(/* @vite-ignore */ runtimePath("workspace_scope")),
+	]);
+	const diffSnapshotOf = (r: string, record: any) => {
+		if (record.contract === "assurance_kernel/task_record/v4") {
+			if (!record.git_base_head)
+				throw new Error("TaskRecord v4 is missing git_base_head");
+			return scopeMod.taskRevisionIdentity(r, record.intent_snapshot.scope_hint, record.git_base_head);
+		}
+		return scopeMod.taskDiffIdentity(r, record.intent_snapshot.scope_hint);
+	};
+	return assuranceMod.projectAssurance(root, taskId, diffSnapshotOf);
+}
+
+export async function findExistingActiveBatch(root: string, initiativeSlug: string): Promise<any> {
+	const { join } = await import("node:path");
+	const { existsSync, readdirSync, readFileSync } = await import("node:fs");
+	const batchesDir = join(root, ".imm", "state", "batches");
+	if (!existsSync(batchesDir)) return null;
+	const files = readdirSync(batchesDir);
+	for (const file of files) {
+		if (!file.endsWith(".json")) continue;
+		let record: any;
+		try {
+			record = JSON.parse(readFileSync(join(batchesDir, file), "utf8"));
+		} catch {
+			// Unreadable Kernel batch state must fail closed: silently treating the
+			// initiative as batchless could authorize a parallel run.
+			return { corrupt: true, path: file };
+		}
+		if (record.contract === "assurance_kernel/batch_run_state/v1" && record.initiative_slug === initiativeSlug) {
+			const validStates = new Set([
+				"prepared",
+				"running",
+				"needs_human",
+				"completed",
+				"budget_stopped",
+				"failed",
+				"rejected",
+			]);
+			if (
+				typeof record.batch_id !== "string" ||
+				typeof record.base_head !== "string" ||
+				!Array.isArray(record.children) ||
+				!validStates.has(record.batch_state)
+			) {
+				return { corrupt: true, path: file };
+			}
+			return record;
+		}
+	}
+	return null;
+}
+
+

package/plugins/immune-brain/dist/BASELINE.md

@@ -2,15 +2,39 @@
 
 ## Shared Guards
 
-- Load detailed workflow text from `dist/` only on invocation.
-- Ask only when missing information changes outcome or risk.
-- Keep edits inside the user-requested Direct scope or the active Managed step boundary.
+- On explicit invocation, read only common constraints and selected section routes
+  from `dist/`; nested modes, examples, recovery, and references load on demand.
+- Ask only when missing information would change the goal, scope, observable behavior, compatibility, risk acceptance, a protected effect, or a fact only the user can supply. Resolve repository facts and delegated technical choices with bounded evidence instead of asking.
+- Keep edits inside the user-requested Direct scope or the enrolled TaskIntent acceptance and `scope_hint`.
+- Stage only explicit task-owned paths. Never use `git add .` or `git add -A` in a dirty worktree.
+- Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
-- Use shallow discovery first.
+- Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
+- Inspect unknown test scripts before execution. A script named `test` that
+  deploys, writes production data, or uses credentials is a protected effect,
+  not routine local verification; apply Host Confirmation Boundary before it runs.
+- Unanswered questions block only dependent commitments or execution. Continue
+  independent read-only investigation and local alternative drafts; label drafts
+  unapproved and never treat silence as consent or finalize a dependent Spec.
+- Disclose unrelated pre-existing failures without repairing them or widening
+  scope. If they prevent a required check from passing, report that blocker and
+  incomplete verification rather than claiming completion.
+- Use bounded evidence to cover affected callers and state owners for shared-contract, security, migration, persistence, or authority changes; the category alone never requires full-directory reads. Stop expanding once the relevant behavior and verification are understood.
 - Lead with conclusion, evidence, and Next Action.
 - Advisory roles do not implement; Managed execution roles do not close QA.
 - An explicit Managed Skill entry stops host-native mutation and routes scope changes to `imm-planner`; Managed execution remains inside its accepted boundary.
 
+Before local edits or checks, read Verification and Local Recovery below. Read-only
+framing does not load that execution guidance.
+
+## Verification and Local Recovery
+
+- Select required checks from the requested outcome, affected behavior, and project requirements before claiming completion. Documentation changes use relevant link, mirror, and contract checks; local logic uses focused tests; shared behavior, build configuration, cross-module changes, and release preparation widen regression coverage. Never reduce required checks merely because they fail.
+- Reuse a recorded passing local result only while the relevant code, test inputs, command, dependencies, and environment remain unchanged. Changed or uncertain inputs require rerunning affected checks. Role handoff alone does not invalidate local evidence; local evidence never replaces Kernel-owned deterministic QA or fresh snapshot-bound Review.
+- Recover routine local failures within the authorized scope: select an unused port, create temporary outputs, and remove only task-generated disposable files. Never overwrite user data or stop an unrelated process to free a port. Before dependency installation, inspect the existing project command, lifecycle scripts, network use, and credential effects; use it only within existing authorization, without dependency or lockfile changes. Unknown or protected effects follow Host Confirmation Boundary.
+- Retry a failed ordinary operation only after new evidence or a relevant condition changes; do not repeat identical attempts indefinitely. This does not authorize retrying a failed native authority gate or an uncertain remote write.
+- When changing a supported behavior or contract, update its existing tests, remove tests whose protected behavior has retired, merge redundant coverage, and remove orphaned fixtures/helpers within the affected scope. For each removal, identify the retired behavior or the remaining coverage and run the surviving related checks. Never delete by age, count, slowness, or flakiness alone. Temporary tests name their exit condition; no per-test registry or repository-wide audit is required.
+
 ## Workflow Activation
 
 Ordinary host input stays host-native and does not run natural-language Managed
@@ -46,11 +70,15 @@ returns to `imm-planner`; an enrolled task resumes through `imm-loop` from the
 current Assurance projection. Do not create or mutate workflow state while
 classifying a non-mutating request.
 
-Stage only explicit task-owned paths. Never use `git add .` or `git add -A` in a dirty worktree.
-
 ### Host Confirmation Boundary
 
-Require exact host confirmation only for privileged effects:
+Require exact host confirmation only for privileged effects. For ordinary
+non-Kernel operations, an explicit user approval already covering the same
+operation, target, and impact is sufficient; ask again only for a material delta.
+A generic continuation or configured preference is not blanket authorization.
+Mandatory native gates and hash-bound manifest approvals still apply.
+
+Privileged effects include:
 
 - publish, release, deployment, or remote-system mutation;
 - destructive or irreversible operations and Git history rewrite;
@@ -65,7 +93,10 @@ Routine Managed enrollment uses one current-Host native confirmation bound to th
 
 State mutations, step activations, QA decisions, and plan switches remain
 strictly sequential. Read-only work — repo exploration, advisory review,
-host probing, planner research — may be dispatched in parallel.
+host probing, planner research — is eligible for parallel dispatch in
+capability terms, but Pi schedules one foreground child at a time: launch one
+child, consume its direct result, then decide whether another child is needed.
+Do not assume multiple foreground Agents run as a concurrent batch.
 
 Parallel dispatch is restricted by capability, not by a closed Skill list. Every
 child delegation packet must enforce read-only advisory behavior: no file edits,
@@ -99,13 +130,15 @@ always run sequentially.
 
 ## Success Criteria
 
-- Direct work closes only under the Direct completion contract above.
-- A Managed Step is ready to execute only when the target result, boundary, and
+- Direct work closes only when the requested result is delivered and the required verification passes: a failed or unavailable required check is reported as incomplete work with its concrete blocker, never as completion. Check breadth follows the request and established project requirements, not a universal full-repository rule. Apply Shared Guards and Verification and Local Recovery for in-scope repair and evidence reuse.
+- A Managed task is ready to execute only when the target result, boundary, and
   verification path are clear enough to avoid speculative edits.
-- A Managed Step is closable only when execution evidence proves the recorded
-  verification path and the active boundary still matches the Plan.
-- Managed scope changes, missing evidence, or structural mismatch return to
-  `imm-planner` instead of being hidden inside execution or QA.
+- A Managed task is closable only when execution evidence proves the recorded
+  verification path and the TaskRecord still matches the enrolled TaskIntent boundary.
+- Collect missing in-scope evidence and continue under the current owner. Missing
+  evidence alone does not require replanning. Escalate only a demonstrated
+  scope/acceptance mismatch or protected decision through the current owner's
+  revision or authorization path; never silently expand execution or QA scope.
 
 ## Retirement Completion
 
@@ -135,4 +168,4 @@ Immune-Brain commands and `.imm` state.
 
 Prefer shallow discovery before full-file reads. Start with file lists,
 `rg` hits, symbol/signature scans, and targeted line ranges; read whole files
-only when the narrower evidence path cannot answer the active Step question.
+only when the narrower evidence path cannot answer the active task question.